We are fully capable of thinking PHP, NPM, and PyPi are trash simultaneously. Though it should also be said that only PHP has had decades of security flaws in the language itself, rather than a package manager.

It's just a very poorly designed language with countless footguns and fucking idiotic standard library functions, on top of being a running joke, security-wise.